Pellegrino rejected the civil claim, calling it meritless and saying that he would defend himself in Vancouver courts.
KelpDAO has filed a lawsuit against LayerZero and its co-founder Bryan Pellegrino, accusing the bridge provider of security failures behind the $292 million exploit of its rsETH token in April.
The suit, filed in British Columbia, is KelpDAO’s most direct attempt yet to hold LayerZero accountable after months of public disagreement over what caused the breach.
KelpDAO Accuses LayerZero of Security Failures
In a statement posted on X on September 25, KelpDAO alleged that the exploit resulted from LayerZero’s failure to disclose weaknesses in its technology and prevent an infiltration of its security infrastructure.
“Rather than take responsibility, over the last few months, LayerZero and Mr. Pellegrino publicly blamed us for their failures,” KelpDAO stated. “But the record is straightforward: LayerZero reviewed and endorsed—in writing—our deployment and configuration of LayerZero’s technology.”
That directly challenges LayerZero’s argument that the attack was isolated to KelpDAO’s rsETH configuration because the bridge used a 1-of-1 Decentralized Verifier Network, or DVN.
Under that setup, LayerZero’s own DVN was the sole verifier, meaning a forged cross-chain message could be accepted without a second independent verifier rejecting it.
LayerZero maintained that it had recommended using multiple DVNs to avoid such a single point of failure. But KelpDAO pushed back on that account in a May 6 report. The protocol argued that the 1-of-1 configuration was not an unusual setup chosen against LayerZero’s guidance. Instead, it claimed the configuration followed LayerZero’s official documentation and default deployment practices.
Up until supposed white-hat hackers drained $320 million from Liquid Network (most of which was returned) and today’s $351 million Bitget hot wallet breach, the KelpDAO incident had been the largest crypto security exploit of 2026.
You may also like:
Cyvers at the time estimated that about $293.7 million in rsETH was drained, with the attacker moving the assets into ETH across Ethereum and Arbitrum, while lending protocols including Aave V3, Compound V3, and Euler were also affected.
Pellegrino Ready to Defend Himself
In its own words, KelpDAO wants to set the record straight and “hold LayerZero and Mr. Pellegrino accountable for the harm they have caused.”
And the LayerZero CEO responded within hours on X, confirming that Evercrest, KelpDAO’s parent entity, had filed a notice of civil claim against him and his company in British Columbia.
“The claim continues to be meritless, will meet them in Vancouver and defend myself accordingly,” he wrote.
Also on X, Solana Foundation’s Seraphim Czecker summed up the mood around founding DeFi as something closer to a Game of Thrones plotline, where you are either at the top making hundreds of millions of dollars or your business is suffocating and dying.
“If you get hacked, you get sued into oblivion and lose years to court battles,” he added.
